Reversing Tenda N300 Router Firmware with Ghidra

Question

Hey I got interested in SRE so I picked up Binwalk and Ghidra though I have some issues. I was reversing a simple bin for Tenda router I did some information gathering:

• Tenda Router & bin file Info
• Processor & Part No => OCA9535 0VV MIPS32 24kc ARCH, Manufacturer & chip info

chip is qca9535, I suspect in ghidra I should use MIPS32 with microchip as language, and under options, load base address of approximately 0x80000000. However, I can't seem to effectively break down the memory blocks,length & offsets. I was looking for the MIPS32 24kc code so that I can trace the memory headers and get their addresses. Could anyone please verify my steps and advice wisely on how to have all memory mapped, thus removing red undefined addresses and strings to be mapped well to their effective address.

See attached image for more info:

Answer 1

So anyway after spending some time on this I grabbed the documents on the instruction set of Mips32 and Mips32 24Kc and read up on memory mapping.

So I went back to ghildra and mapped the Flash memory, RAM=> (volatile) and Peripheral memory and eventually the data was traced and referenced. So bottom line is when you identify a processor and its architeture. Find the technical documentation on instruction set, then use it to map memory on Ghidra. Also you can use the python script shell in Ghildra to map/view/modify current program memory.

In addition you might need SVD file => tool to load SVD, to trace the memory address to their respective chip registers.Either way, good information gathering really helps in SRE. Other answers can be forwarded.